If Loading the item results in an openssl error,
even if the item is not empty, discard it.
Otherwise loading it from the database later on will fail.
Improve "autoIntName()"
Print digest of public keys in the key details in different formats:
Print SHA256 SSH digest as used to by SSH users:
ssh-keygen -l -f ~/.ssh/id_rsa.pub
Print SHA1 X509 key digest as shown in the
Subject key identifier of a certificate
Print SHA256 digest as in:
openssl pkey -pubout -outform DER < key.pem | sha256sum
as requested by this issue.
Refactored digesting functionality by a generic Digest()
function working with QByteArrays.
The function formatHash() now also expects a QByteArray input.
Allow displaying the public key of a certificate
or request without importing it.
When importing certificates or CRLs,
display the issuer if it exists in the database.
This is a large squash of many small commits.
Allow porting data from the legacy format to SQL.
Store Binaries base64 encoded and use db->transaction
Update password hash to be 8000 x SHA512 with 8 byte Salt
Add revocations table and fixup CRL generation
Add comment and insertion date columns
Fix column saving, remove trust, add XcaDialog
Allow changing the internal name and comment in Cert/Req details view
Extend Comment functionality, Replace About.ui by XcaDialog.ui
If the database password is empty, dumping private keys
resulted in an error message.
Fix this by setting the encryption algorithm to NULL if
the password is empty.
Additionally throw the error after closing the filedescriptor.
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
On startup use "/dev/random" and "/dev/hwrng"
as additional entropy for the OpenSSL random pool.
Collect mouse position and key press time entropy
for seeding the openssl random pool before generating keys.
When using Smartcards, use the Smartcard RNG
as additional entropy source.
